mirror of
https://github.com/bitnami/charts.git
synced 2026-03-08 08:47:24 +08:00
1051 lines
43 KiB
YAML
1051 lines
43 KiB
YAML
# Copyright VMware, Inc.
|
||
# SPDX-License-Identifier: APACHE-2.0
|
||
|
||
## @section Global parameters
|
||
## Global Docker image parameters
|
||
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
|
||
## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
|
||
##
|
||
|
||
## @param global.imageRegistry Global Docker image registry
|
||
## @param global.imagePullSecrets Global Docker registry secret names as an array
|
||
## @param global.storageClass Global StorageClass for Persistent Volume(s)
|
||
##
|
||
global:
|
||
imageRegistry: ""
|
||
## E.g.
|
||
## imagePullSecrets:
|
||
## - myRegistryKeySecretName
|
||
##
|
||
imagePullSecrets: []
|
||
storageClass: ""
|
||
|
||
## @section Common parameters
|
||
##
|
||
|
||
## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)
|
||
##
|
||
kubeVersion: ""
|
||
## @param nameOverride String to partially override matomo.fullname template (will maintain the release name)
|
||
##
|
||
nameOverride: ""
|
||
## @param fullnameOverride String to fully override matomo.fullname template
|
||
##
|
||
fullnameOverride: ""
|
||
## @param namespaceOverride String to fully override common.names.namespace
|
||
##
|
||
namespaceOverride: ""
|
||
## @param commonAnnotations Common annotations to add to all Matomo resources (sub-charts are not considered). Evaluated as a template
|
||
##
|
||
commonAnnotations: {}
|
||
## @param commonLabels Common labels to add to all Matomo resources (sub-charts are not considered). Evaluated as a template
|
||
##
|
||
commonLabels: {}
|
||
|
||
## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template).
|
||
##
|
||
extraDeploy: []
|
||
|
||
## @section Matomo parameters
|
||
##
|
||
|
||
## Bitnami Matomo image version
|
||
## ref: https://hub.docker.com/r/bitnami/matomo/tags/
|
||
## @param image.registry [default: REGISTRY_NAME] Matomo image registry
|
||
## @param image.repository [default: REPOSITORY_NAME/matomo] Matomo Image name
|
||
## @skip image.tag Matomo Image tag
|
||
## @param image.digest Matomo image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||
## @param image.pullPolicy Matomo image pull policy
|
||
## @param image.pullSecrets Specify docker-registry secret names as an array
|
||
## @param image.debug Specify if debug logs should be enabled
|
||
##
|
||
image:
|
||
registry: docker.io
|
||
repository: bitnami/matomo
|
||
tag: 5.0.1-debian-11-r2
|
||
digest: ""
|
||
## Specify a imagePullPolicy
|
||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
|
||
##
|
||
pullPolicy: IfNotPresent
|
||
## Optionally specify an array of imagePullSecrets.
|
||
## Secrets must be manually created in the namespace.
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||
## e.g:
|
||
## pullSecrets:
|
||
## - myRegistryKeySecretName
|
||
##
|
||
pullSecrets: []
|
||
## Set to true if you would like to see extra information on logs
|
||
##
|
||
debug: false
|
||
## @param replicaCount Number of Matomo Pods to run (requires ReadWriteMany PVC support)
|
||
##
|
||
replicaCount: 1
|
||
## @param matomoUsername User of the application
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo#configuration
|
||
##
|
||
matomoUsername: user
|
||
## @param matomoPassword Application password
|
||
## Defaults to a random 10-character alphanumeric string if not set
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo#configuration
|
||
##
|
||
matomoPassword: ""
|
||
## @param matomoEmail Admin email
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo#configuration
|
||
##
|
||
matomoEmail: user@example.com
|
||
## @param matomoWebsiteName Matomo application name
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo#configuration
|
||
##
|
||
matomoWebsiteName: example
|
||
## @param matomoWebsiteHost Matomo application host
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo#configuration
|
||
##
|
||
matomoWebsiteHost: https://example.org
|
||
## @param matomoSkipInstall Skip Matomo installation wizard. Useful for migrations and restoring from SQL dump
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo#configuration
|
||
##
|
||
matomoSkipInstall: false
|
||
## @param customPostInitScripts Custom post-init.d user scripts
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/dokuwiki
|
||
## NOTE: supported formats are `.sh` or `.php`
|
||
## NOTE: scripts are exclusively executed during the 1st boot of the container
|
||
## e.g:
|
||
## customPostInitScripts:
|
||
## custom-post-init.sh: |
|
||
## #!/bin/bash
|
||
## echo "Hello from custom-post-init.sh"
|
||
## .htaccess: |
|
||
## RewriteEngine On
|
||
## RewriteBase /
|
||
## ...
|
||
##
|
||
customPostInitScripts: {}
|
||
## @param allowEmptyPassword Allow DB blank passwords
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo#environment-variables
|
||
##
|
||
allowEmptyPassword: true
|
||
## @param command Override default container command (useful when using custom images)
|
||
##
|
||
command: []
|
||
## @param args Override default container args (useful when using custom images)
|
||
##
|
||
args: []
|
||
## @param updateStrategy.type Update strategy - only really applicable for deployments with RWO PVs attached
|
||
## If replicas = 1, an update can get "stuck", as the previous pod remains attached to the
|
||
## PV, and the "incoming" pod can never start. Changing the strategy to "Recreate" will
|
||
## terminate the single previous pod, so that the new, incoming pod can attach to the PV
|
||
##
|
||
updateStrategy:
|
||
type: RollingUpdate
|
||
## @param priorityClassName Matomo pods' priorityClassName
|
||
##
|
||
priorityClassName: ""
|
||
## @param schedulerName Name of the k8s scheduler (other than default)
|
||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||
##
|
||
schedulerName: ""
|
||
## @param topologySpreadConstraints Topology Spread Constraints for pod assignment
|
||
## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||
## The value is evaluated as a template
|
||
##
|
||
topologySpreadConstraints: []
|
||
## @param automountServiceAccountToken Mount Service Account token in pod
|
||
##
|
||
automountServiceAccountToken: true
|
||
## @param hostAliases [array] Add deployment host aliases
|
||
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
|
||
##
|
||
hostAliases:
|
||
## Necessary for apache-exporter to work
|
||
##
|
||
- ip: "127.0.0.1"
|
||
hostnames:
|
||
- "status.localhost"
|
||
## @param extraEnvVars Extra environment variables
|
||
## For example:
|
||
##
|
||
extraEnvVars: []
|
||
# - name: BEARER_AUTH
|
||
# value: true
|
||
## @param extraEnvVarsCM ConfigMap containing extra env vars
|
||
##
|
||
extraEnvVarsCM: ""
|
||
## @param extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data)
|
||
##
|
||
extraEnvVarsSecret: ""
|
||
## @param extraVolumes Array of extra volumes to be added to the deployment (evaluated as template). Requires setting `extraVolumeMounts`
|
||
##
|
||
extraVolumes: []
|
||
## @param extraVolumeMounts Array of extra volume mounts to be added to the container (evaluated as template). Normally used with `extraVolumes`.
|
||
##
|
||
extraVolumeMounts: []
|
||
## @param initContainers Add additional init containers to the pod (evaluated as a template)
|
||
##
|
||
initContainers: []
|
||
## @param sidecars Attach additional containers to the pod (evaluated as a template)
|
||
##
|
||
sidecars: []
|
||
## @param serviceAccountName Attach serviceAccountName to the pod and sidecars
|
||
##
|
||
serviceAccountName: ""
|
||
## @param tolerations Tolerations for pod assignment
|
||
## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||
##
|
||
tolerations: []
|
||
## @param existingSecret Name of a secret with the application password
|
||
##
|
||
existingSecret: ""
|
||
## SMTP mail delivery configuration
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/matomo/#smtp-configuration
|
||
## @param smtpAuth SMTP authentication mechanism (options: Plain, Login, Crammd5)
|
||
## @param smtpHost SMTP host
|
||
## @param smtpPort SMTP port
|
||
## @param smtpUser SMTP user
|
||
## @param smtpPassword SMTP password
|
||
## @param smtpProtocol SMTP Protocol (options: ssl,tls, nil)
|
||
## @param noreplyName Noreply name
|
||
## @param noreplyAddress Noreply address
|
||
##
|
||
smtpAuth: ""
|
||
smtpHost: ""
|
||
smtpPort: ""
|
||
smtpUser: ""
|
||
smtpPassword: ""
|
||
smtpProtocol: ""
|
||
noreplyName: ""
|
||
noreplyAddress: ""
|
||
## @param smtpExistingSecret The name of an existing secret with SMTP credentials
|
||
## NOTE: Must contain key `smtp-password`
|
||
## NOTE: When it's set, the `smtpPassword` parameter is ignored
|
||
##
|
||
smtpExistingSecret: ""
|
||
## @param containerPorts [object] Container ports
|
||
##
|
||
containerPorts:
|
||
http: 8080
|
||
https: 8443
|
||
## Enable persistence using Persistent Volume Claims
|
||
## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
|
||
##
|
||
persistence:
|
||
## @param persistence.enabled Enable persistence using PVC
|
||
##
|
||
enabled: true
|
||
## @param persistence.storageClass PVC Storage Class for Matomo volume
|
||
## If defined, storageClassName: <storageClass>
|
||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||
## If undefined (the default) or set to null, no storageClassName spec is
|
||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||
## GKE, AWS & OpenStack)
|
||
##
|
||
storageClass: ""
|
||
## @param persistence.accessModes PVC Access Mode for Matomo volume
|
||
## Requires persistence.enabled: true
|
||
## If defined, PVC must be created manually before volume will be bound
|
||
##
|
||
accessModes:
|
||
- ReadWriteOnce
|
||
## @param persistence.size PVC Storage Request for Matomo volume
|
||
##
|
||
size: 8Gi
|
||
## @param persistence.dataSource Custom PVC data source
|
||
##
|
||
dataSource: {}
|
||
## @param persistence.existingClaim A manually managed Persistent Volume Claim
|
||
## Requires persistence.enabled: true
|
||
## If defined, PVC must be created manually before volume will be bound
|
||
##
|
||
existingClaim: ""
|
||
## @param persistence.hostPath If defined, the matomo-data volume will mount to the specified hostPath.
|
||
## Requires persistence.enabled: true
|
||
## Requires persistence.existingClaim: nil|false
|
||
## Default: nil.
|
||
##
|
||
hostPath: ""
|
||
## @param persistence.annotations Persistent Volume Claim annotations
|
||
##
|
||
annotations: {}
|
||
## @param persistence.selector Selector to match an existing Persistent Volume for Matomo data PVC
|
||
## If set, the PVC can't have a PV dynamically provisioned for it
|
||
## E.g.
|
||
## selector:
|
||
## matchLabels:
|
||
## app: my-app
|
||
##
|
||
selector: {}
|
||
|
||
## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||
##
|
||
podAffinityPreset: ""
|
||
## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
|
||
##
|
||
podAntiAffinityPreset: soft
|
||
## Node affinity preset
|
||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
|
||
## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
|
||
## @param nodeAffinityPreset.key Node label key to match Ignored if `affinity` is set.
|
||
## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set.
|
||
##
|
||
nodeAffinityPreset:
|
||
type: ""
|
||
## E.g.
|
||
## key: "kubernetes.io/e2e-az-name"
|
||
##
|
||
key: ""
|
||
## E.g.
|
||
## values:
|
||
## - e2e-az1
|
||
## - e2e-az2
|
||
##
|
||
values: []
|
||
## @param affinity Affinity for pod assignment
|
||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||
## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
|
||
##
|
||
affinity: {}
|
||
## @param nodeSelector Node labels for pod assignment. Evaluated as a template.
|
||
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||
##
|
||
nodeSelector: {}
|
||
## Matomo container's resource requests and limits
|
||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||
## choice for the user. This also increases chances charts run on environments with little
|
||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||
## @param resources.limits The resources limits for Matomo containers
|
||
## @param resources.requests The requested resources for Matomo containers
|
||
##
|
||
resources:
|
||
## Example:
|
||
## limits:
|
||
## cpu: 500m
|
||
## memory: 1Gi
|
||
limits: {}
|
||
## Examples:
|
||
## requests:
|
||
## cpu: 250m
|
||
## memory: 256Mi
|
||
requests: {}
|
||
## Configure Pods Security Context
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||
## @param podSecurityContext.enabled Enable Matomo pods' Security Context
|
||
## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
|
||
## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
|
||
## @param podSecurityContext.supplementalGroups Set filesystem extra groups
|
||
## @param podSecurityContext.fsGroup Matomo pods' group ID
|
||
##
|
||
podSecurityContext:
|
||
enabled: true
|
||
fsGroupChangePolicy: Always
|
||
sysctls: []
|
||
supplementalGroups: []
|
||
fsGroup: 1001
|
||
## Configure Container Security Context (only main container)
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||
## @param containerSecurityContext.enabled Enabled containers' Security Context
|
||
## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||
## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser
|
||
## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
|
||
## @param containerSecurityContext.privileged Set container's Security Context privileged
|
||
## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
|
||
## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
|
||
## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped
|
||
## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
|
||
##
|
||
containerSecurityContext:
|
||
enabled: true
|
||
seLinuxOptions: null
|
||
runAsUser: 1001
|
||
runAsNonRoot: true
|
||
privileged: false
|
||
readOnlyRootFilesystem: false
|
||
allowPrivilegeEscalation: false
|
||
capabilities:
|
||
drop: ["ALL"]
|
||
seccompProfile:
|
||
type: "RuntimeDefault"
|
||
## Configure extra options for startup probe
|
||
## Matomo core exposes / to unauthenticated requests, making it a good
|
||
## default startup and readiness path. However, that may not always be the
|
||
## case. For example, if the image value is overridden to an image containing a
|
||
## module that alters that route, or an image that does not auto-install Matomo.
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
|
||
## @param startupProbe.enabled Enable startupProbe
|
||
## @param startupProbe.path Request path for startupProbe
|
||
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||
## @param startupProbe.periodSeconds Period seconds for startupProbe
|
||
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||
## @param startupProbe.failureThreshold Failure threshold for startupProbe
|
||
## @param startupProbe.successThreshold Success threshold for startupProbe
|
||
##
|
||
startupProbe:
|
||
enabled: false
|
||
path: /matomo.php
|
||
initialDelaySeconds: 600
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
## Configure extra options for liveness probe
|
||
## Matomo core exposes / to unauthenticated requests, making it a good
|
||
## default liveness and readiness path. However, that may not always be the
|
||
## case. For example, if the image value is overridden to an image containing a
|
||
## module that alters that route, or an image that does not auto-install Matomo.
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
|
||
## @param livenessProbe.enabled Enable livenessProbe
|
||
## @param livenessProbe.path Request path for livenessProbe
|
||
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
||
## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
|
||
## @param livenessProbe.failureThreshold Failure threshold for livenessProbe
|
||
## @param livenessProbe.successThreshold Success threshold for livenessProbe
|
||
##
|
||
livenessProbe:
|
||
enabled: true
|
||
path: /matomo.php
|
||
initialDelaySeconds: 600
|
||
periodSeconds: 10
|
||
timeoutSeconds: 5
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
## Configure extra options for readiness probe
|
||
## Matomo core exposes / to unauthenticated requests, making it a good
|
||
## default liveness and readiness path. However, that may not always be the
|
||
## case. For example, if the image value is overridden to an image containing a
|
||
## module that alters that route, or an image that does not auto-install Matomo.
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
|
||
## @param readinessProbe.enabled Enable readinessProbe
|
||
## @param readinessProbe.path Request path for readinessProbe
|
||
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
||
## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
|
||
## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
|
||
## @param readinessProbe.successThreshold Success threshold for readinessProbe
|
||
##
|
||
readinessProbe:
|
||
enabled: true
|
||
path: /matomo.php
|
||
initialDelaySeconds: 30
|
||
periodSeconds: 5
|
||
timeoutSeconds: 1
|
||
failureThreshold: 5
|
||
successThreshold: 1
|
||
## @param customStartupProbe Override default startup probe
|
||
##
|
||
customStartupProbe: {}
|
||
## @param customLivenessProbe Override default liveness probe
|
||
##
|
||
customLivenessProbe: {}
|
||
## @param customReadinessProbe Override default readiness probe
|
||
##
|
||
customReadinessProbe: {}
|
||
## @param lifecycleHooks LifecycleHook to set additional configuration at startup Evaluated as a template
|
||
##
|
||
lifecycleHooks: {}
|
||
## @param podAnnotations Pod annotations
|
||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||
##
|
||
podAnnotations: {}
|
||
## @param podLabels Add additional labels to the pod (evaluated as a template)
|
||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||
##
|
||
podLabels: {}
|
||
|
||
## @section Traffic Exposure Parameters
|
||
##
|
||
|
||
## Kubernetes configuration. For minikube, set this to NodePort, elsewhere use LoadBalancer
|
||
##
|
||
service:
|
||
## @param service.type Kubernetes Service type
|
||
##
|
||
type: LoadBalancer
|
||
## @param service.ports.http Service HTTP port
|
||
## @param service.ports.https Service HTTPS port
|
||
##
|
||
ports:
|
||
http: 80
|
||
https: 443
|
||
## @param service.loadBalancerSourceRanges Restricts access for LoadBalancer (only with `service.type: LoadBalancer`)
|
||
## e.g:
|
||
## loadBalancerSourceRanges:
|
||
## - 0.0.0.0/0
|
||
##
|
||
loadBalancerSourceRanges: []
|
||
## @param service.loadBalancerIP loadBalancerIP for the Matomo Service (optional, cloud specific)
|
||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer
|
||
##
|
||
loadBalancerIP: ""
|
||
## @param service.nodePorts [object] Kubernetes node port
|
||
## nodePorts:
|
||
## http: <to set explicitly, choose port between 30000-32767>
|
||
## https: <to set explicitly, choose port between 30000-32767>
|
||
##
|
||
nodePorts:
|
||
http: ""
|
||
https: ""
|
||
## @param service.externalTrafficPolicy Enable client source IP preservation
|
||
## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||
##
|
||
externalTrafficPolicy: Cluster
|
||
## @param service.clusterIP Matomo service Cluster IP
|
||
## e.g.:
|
||
## clusterIP: None
|
||
##
|
||
clusterIP: ""
|
||
## @param service.extraPorts Extra ports to expose (normally used with the `sidecar` value)
|
||
##
|
||
extraPorts: []
|
||
## @param service.annotations Additional custom annotations for Matomo service
|
||
##
|
||
annotations: {}
|
||
## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"
|
||
## If "ClientIP", consecutive client requests will be directed to the same Pod
|
||
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
|
||
##
|
||
sessionAffinity: None
|
||
## @param service.sessionAffinityConfig Additional settings for the sessionAffinity
|
||
## sessionAffinityConfig:
|
||
## clientIP:
|
||
## timeoutSeconds: 300
|
||
##
|
||
sessionAffinityConfig: {}
|
||
## Configure the ingress resource that allows you to access the
|
||
## Matomo installation. Set up the URL
|
||
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
||
##
|
||
ingress:
|
||
## @param ingress.enabled Enable ingress controller resource
|
||
##
|
||
enabled: false
|
||
|
||
## @param ingress.pathType Ingress Path type
|
||
##
|
||
pathType: ImplementationSpecific
|
||
## @param ingress.apiVersion Override API Version (automatically detected if not set)
|
||
##
|
||
apiVersion: ""
|
||
## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
|
||
## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .
|
||
## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
|
||
##
|
||
ingressClassName: ""
|
||
## @param ingress.hostname Default host for the ingress resource
|
||
##
|
||
hostname: "matomo.local"
|
||
## @param ingress.path The Path to Matomo. You may need to set this to '/*' in order to use this
|
||
## with ALB ingress controllers.
|
||
##
|
||
path: /
|
||
## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
|
||
## For a full list of possible ingress annotations, please see
|
||
## ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md
|
||
## Use this parameter to set the required annotations for cert-manager, see
|
||
## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
|
||
##
|
||
## e.g:
|
||
## annotations:
|
||
## kubernetes.io/ingress.class: nginx
|
||
## cert-manager.io/cluster-issuer: cluster-issuer-name
|
||
##
|
||
annotations: {}
|
||
## @param ingress.tls Enable TLS configuration for the hostname defined at ingress.hostname parameter
|
||
## TLS certificates will be retrieved from a TLS secret with name: {{- printf "%s-tls" .Values.ingress.hostname }}
|
||
## You can use the ingress.secrets parameter to create this TLS secret or relay on cert-manager to create it
|
||
##
|
||
tls: false
|
||
## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
|
||
##
|
||
selfSigned: false
|
||
## @param ingress.extraHosts The list of additional hostnames to be covered with this ingress record.
|
||
## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array
|
||
## extraHosts:
|
||
## - name: matomo.local
|
||
## path: /
|
||
##
|
||
extraHosts: []
|
||
## @param ingress.extraPaths Any additional arbitrary paths that may need to be added to the ingress under the main host.
|
||
## For example: The ALB ingress controller requires a special rule for handling SSL redirection.
|
||
## extraPaths:
|
||
## - path: /*
|
||
## backend:
|
||
## serviceName: ssl-redirect
|
||
## servicePort: use-annotation
|
||
##
|
||
extraPaths: []
|
||
## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record.
|
||
## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
|
||
## extraTls:
|
||
## - hosts:
|
||
## - matomo.local
|
||
## secretName: matomo.local-tls
|
||
##
|
||
extraTls: []
|
||
## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets
|
||
## key and certificate should start with -----BEGIN CERTIFICATE----- or
|
||
## -----BEGIN RSA PRIVATE KEY-----
|
||
##
|
||
## name should line up with a tlsSecret set further up
|
||
## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set
|
||
##
|
||
## It is also possible to create and manage the certificates outside of this helm chart
|
||
## Please see README.md for more information
|
||
## Example:
|
||
## - name: matomo.local-tls
|
||
## key:
|
||
## certificate:
|
||
##
|
||
secrets: []
|
||
## @param ingress.extraRules Additional rules to be covered with this ingress record
|
||
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
|
||
## e.g:
|
||
## extraRules:
|
||
## - host: example.local
|
||
## http:
|
||
## path: /
|
||
## backend:
|
||
## service:
|
||
## name: example-svc
|
||
## port:
|
||
## name: http
|
||
##
|
||
extraRules: []
|
||
|
||
## @section Database parameters
|
||
##
|
||
|
||
## MariaDB chart configuration
|
||
## https://github.com/bitnami/charts/blob/main/bitnami/mariadb/values.yaml
|
||
##
|
||
mariadb:
|
||
## @param mariadb.enabled Whether to deploy a mariadb server to satisfy the applications database requirements
|
||
## To use an external database set this to false and configure the externalDatabase parameters
|
||
##
|
||
enabled: true
|
||
## @param mariadb.architecture MariaDB architecture (`standalone` or `replication`)
|
||
##
|
||
architecture: standalone
|
||
## MariaDB Authentication parameters
|
||
## @param mariadb.auth.rootPassword Password for the MariaDB `root` user
|
||
## @param mariadb.auth.database Database name to create
|
||
## @param mariadb.auth.username Database user to create
|
||
## @param mariadb.auth.password Password for the database
|
||
##
|
||
auth:
|
||
## ref: https://github.com/bitnami/containers/tree/main/bitnami/mariadb#setting-the-root-password-on-first-run
|
||
##
|
||
rootPassword: ""
|
||
## ref: https://github.com/bitnami/containers/blob/main/bitnami/mariadb/README.md#creating-a-database-on-first-run
|
||
##
|
||
database: bitnami_matomo
|
||
## ref: https://github.com/bitnami/containers/blob/main/bitnami/mariadb/README.md#creating-a-database-user-on-first-run
|
||
##
|
||
username: bn_matomo
|
||
password: ""
|
||
primary:
|
||
## Enable persistence using Persistent Volume Claims
|
||
## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
|
||
## @param mariadb.primary.persistence.enabled Enable database persistence using PVC
|
||
## @param mariadb.primary.persistence.storageClass MariaDB primary persistent volume storage Class
|
||
## @param mariadb.primary.persistence.accessModes Database Persistent Volume Access Modes
|
||
## @param mariadb.primary.persistence.size Database Persistent Volume Size
|
||
## @param mariadb.primary.persistence.hostPath Set path in case you want to use local host path volumes (not recommended in production)
|
||
## @param mariadb.primary.persistence.existingClaim Name of an existing `PersistentVolumeClaim` for MariaDB primary replicas
|
||
##
|
||
persistence:
|
||
enabled: true
|
||
## mariadb data Persistent Volume Storage Class
|
||
## If defined, storageClassName: <storageClass>
|
||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||
## If undefined (the default) or set to null, no storageClassName spec is
|
||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||
## GKE, AWS & OpenStack)
|
||
##
|
||
storageClass: ""
|
||
accessModes:
|
||
- ReadWriteOnce
|
||
size: 8Gi
|
||
hostPath: ""
|
||
existingClaim: ""
|
||
## External database configuration
|
||
## @param externalDatabase.host Host of the existing database
|
||
## @param externalDatabase.port Port of the existing database
|
||
## @param externalDatabase.user Existing username in the external db
|
||
## @param externalDatabase.password Password for the above username
|
||
## @param externalDatabase.database Name of the existing database
|
||
## @param externalDatabase.existingSecret Name of a secret containing the database credentials
|
||
##
|
||
externalDatabase:
|
||
host: ""
|
||
port: 3306
|
||
user: bn_matomo
|
||
password: ""
|
||
database: bitnami_matomo
|
||
existingSecret: ""
|
||
|
||
## @section Volume Permissions parameters
|
||
##
|
||
|
||
## Init containers parameters:
|
||
## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.
|
||
##
|
||
volumePermissions:
|
||
## @param volumePermissions.enabled Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work)
|
||
##
|
||
enabled: false
|
||
## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry
|
||
## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image name
|
||
## @skip volumePermissions.image.tag Init container volume-permissions image tag
|
||
## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||
## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy
|
||
## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array
|
||
##
|
||
image:
|
||
registry: docker.io
|
||
repository: bitnami/os-shell
|
||
tag: 11-debian-11-r95
|
||
digest: ""
|
||
pullPolicy: IfNotPresent
|
||
## Optionally specify an array of imagePullSecrets.
|
||
## Secrets must be manually created in the namespace.
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||
## e.g:
|
||
## pullSecrets:
|
||
## - myRegistryKeySecretName
|
||
##
|
||
pullSecrets: []
|
||
## Init containers' resource requests and limits
|
||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||
## We usually recommend not to specify default resources and to leave this as a conscious
|
||
## choice for the user. This also increases chances charts run on environments with little
|
||
## resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||
## @param volumePermissions.resources.limits The resources limits for the container
|
||
## @param volumePermissions.resources.requests The requested resources for the container
|
||
##
|
||
resources:
|
||
## Example:
|
||
## limits:
|
||
## cpu: 100m
|
||
## memory: 128Mi
|
||
##
|
||
limits: {}
|
||
## Examples:
|
||
## requests:
|
||
## cpu: 100m
|
||
## memory: 128Mi
|
||
##
|
||
requests: {}
|
||
|
||
## @section Metrics parameters
|
||
##
|
||
|
||
## Prometheus Exporter / Metrics
|
||
##
|
||
metrics:
|
||
## @param metrics.enabled Start a exporter side-car
|
||
##
|
||
enabled: false
|
||
## @param metrics.image.registry [default: REGISTRY_NAME] Apache exporter image registry
|
||
## @param metrics.image.repository [default: REPOSITORY_NAME/apache-exporter] Apache exporter image repository
|
||
## @skip metrics.image.tag Apache exporter image tag
|
||
## @param metrics.image.digest Apache exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||
## @param metrics.image.pullPolicy Image pull policy
|
||
## @param metrics.image.pullSecrets Specify docker-registry secret names as an array
|
||
##
|
||
image:
|
||
registry: docker.io
|
||
repository: bitnami/apache-exporter
|
||
tag: 1.0.5-debian-11-r4
|
||
digest: ""
|
||
pullPolicy: IfNotPresent
|
||
## Optionally specify an array of imagePullSecrets.
|
||
## Secrets must be manually created in the namespace.
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||
## e.g:
|
||
## pullSecrets:
|
||
## - myRegistryKeySecretName
|
||
##
|
||
pullSecrets: []
|
||
## @param metrics.resources Metrics exporter resource requests and limits
|
||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||
##
|
||
resources: {}
|
||
##
|
||
## @param metrics.podAnnotations [object] Additional annotations for Metrics exporter pod
|
||
##
|
||
podAnnotations:
|
||
prometheus.io/scrape: "true"
|
||
prometheus.io/port: "9117"
|
||
|
||
## @section Certificate injection parameters
|
||
##
|
||
|
||
## Add custom certificates and certificate authorities to matomo container
|
||
##
|
||
certificates:
|
||
## @param certificates.customCertificate.certificateSecret Secret containing the certificate and key to add
|
||
## @param certificates.customCertificate.chainSecret.name Name of the secret containing the certificate chain
|
||
## @param certificates.customCertificate.chainSecret.key Key of the certificate chain file inside the secret
|
||
## @param certificates.customCertificate.certificateLocation Location in the container to store the certificate
|
||
## @param certificates.customCertificate.keyLocation Location in the container to store the private key
|
||
## @param certificates.customCertificate.chainLocation Location in the container to store the certificate chain
|
||
##
|
||
customCertificate:
|
||
certificateSecret: ""
|
||
chainSecret:
|
||
name: secret-name
|
||
key: secret-key
|
||
certificateLocation: /etc/ssl/certs/ssl-cert-snakeoil.pem
|
||
keyLocation: /etc/ssl/private/ssl-cert-snakeoil.key
|
||
chainLocation: /etc/ssl/certs/mychain.pem
|
||
## @param certificates.customCAs Defines a list of secrets to import into the container trust store
|
||
##
|
||
customCAs: []
|
||
## @param certificates.command Override default container command (useful when using custom images)
|
||
##
|
||
command: []
|
||
## @param certificates.args Override default container args (useful when using custom images)
|
||
##
|
||
args: []
|
||
## @param certificates.extraEnvVars Container sidecar extra environment variables (eg proxy)
|
||
##
|
||
extraEnvVars: []
|
||
## @param certificates.extraEnvVarsCM ConfigMap containing extra env vars
|
||
##
|
||
extraEnvVarsCM: ""
|
||
## @param certificates.extraEnvVarsSecret Secret containing extra env vars (in case of sensitive data)
|
||
##
|
||
extraEnvVarsSecret: ""
|
||
## @param certificates.image.registry [default: REGISTRY_NAME] Container sidecar registry
|
||
## @param certificates.image.repository [default: REPOSITORY_NAME/os-shell] Container sidecar image
|
||
## @skip certificates.image.tag Container sidecar image tag
|
||
## @param certificates.image.digest Container sidecar image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
|
||
## @param certificates.image.pullPolicy Container sidecar image pull policy
|
||
## @param certificates.image.pullSecrets Container sidecar image pull secrets
|
||
##
|
||
image:
|
||
registry: docker.io
|
||
repository: bitnami/os-shell
|
||
tag: 11-debian-11-r95
|
||
digest: ""
|
||
## Specify a imagePullPolicy
|
||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
|
||
##
|
||
pullPolicy: IfNotPresent
|
||
## e.g:
|
||
## pullSecrets:
|
||
## - myRegistryKeySecretName
|
||
##
|
||
pullSecrets: []
|
||
|
||
## @section NetworkPolicy parameters
|
||
##
|
||
|
||
## Add networkpolicies
|
||
##
|
||
networkPolicy:
|
||
## @param networkPolicy.enabled Enable network policies
|
||
## If ingress.enabled or metrics.enabled are true, configure networkPolicy.ingress and networkPolicy.metrics selectors respectively to allow communication
|
||
##
|
||
enabled: false
|
||
## @param networkPolicy.metrics.enabled Enable network policy for metrics (prometheus)
|
||
## @param networkPolicy.metrics.namespaceSelector [object] Monitoring namespace selector labels. These labels will be used to identify the prometheus' namespace.
|
||
## @param networkPolicy.metrics.podSelector [object] Monitoring pod selector labels. These labels will be used to identify the Prometheus pods.
|
||
##
|
||
metrics:
|
||
enabled: false
|
||
## e.g:
|
||
## podSelector:
|
||
## label: monitoring
|
||
##
|
||
podSelector: {}
|
||
## e.g:
|
||
## namespaceSelector:
|
||
## label: monitoring
|
||
##
|
||
namespaceSelector: {}
|
||
## @param networkPolicy.ingress.enabled Enable network policy for Ingress Proxies
|
||
## @param networkPolicy.ingress.namespaceSelector [object] Ingress Proxy namespace selector labels. These labels will be used to identify the Ingress Proxy's namespace.
|
||
## @param networkPolicy.ingress.podSelector [object] Ingress Proxy pods selector labels. These labels will be used to identify the Ingress Proxy pods.
|
||
##
|
||
ingress:
|
||
enabled: false
|
||
## e.g:
|
||
## podSelector:
|
||
## label: ingress
|
||
##
|
||
podSelector: {}
|
||
## e.g:
|
||
## namespaceSelector:
|
||
## label: ingress
|
||
##
|
||
namespaceSelector: {}
|
||
## @param networkPolicy.ingressRules.backendOnlyAccessibleByFrontend Enable ingress rule that makes the backend (mariadb) only accessible by matomo's pods.
|
||
## @param networkPolicy.ingressRules.customBackendSelector [object] Backend selector labels. These labels will be used to identify the backend pods.
|
||
## @param networkPolicy.ingressRules.accessOnlyFrom.enabled Enable ingress rule that makes matomo only accessible from a particular origin
|
||
## @param networkPolicy.ingressRules.accessOnlyFrom.namespaceSelector [object] Namespace selector label that is allowed to access matomo. This label will be used to identified the allowed namespace(s).
|
||
## @param networkPolicy.ingressRules.accessOnlyFrom.podSelector [object] Pods selector label that is allowed to access matomo. This label will be used to identified the allowed pod(s).
|
||
## @param networkPolicy.ingressRules.customRules [object] Custom network policy ingress rule
|
||
##
|
||
ingressRules:
|
||
## mariadb backend only can be accessed from matomo
|
||
##
|
||
backendOnlyAccessibleByFrontend: false
|
||
customBackendSelector: {}
|
||
## Allow only from the indicated:
|
||
##
|
||
accessOnlyFrom:
|
||
enabled: false
|
||
## e.g:
|
||
## namespaceSelector:
|
||
## label: ingress
|
||
##
|
||
namespaceSelector: {}
|
||
## e.g:
|
||
## podSelector:
|
||
## label: access
|
||
##
|
||
podSelector: {}
|
||
## custom ingress rules
|
||
## e.g:
|
||
## customRules:
|
||
## - from:
|
||
## - namespaceSelector:
|
||
## matchLabels:
|
||
## label: example
|
||
##
|
||
customRules: {}
|
||
## @param networkPolicy.egressRules.denyConnectionsToExternal Enable egress rule that denies outgoing traffic outside the cluster, except for DNS (port 53).
|
||
## @param networkPolicy.egressRules.customRules [object] Custom network policy rule
|
||
##
|
||
egressRules:
|
||
# Deny connections to external. This is not compatible with an external database.
|
||
denyConnectionsToExternal: false
|
||
## Additional custom egress rules
|
||
## e.g:
|
||
## customRules:
|
||
## - to:
|
||
## - namespaceSelector:
|
||
## matchLabels:
|
||
## label: example
|
||
##
|
||
customRules: {}
|
||
|
||
## @section CronJob parameters
|
||
##
|
||
|
||
cronjobs:
|
||
## DEPRECATED @param cronjobs.enabled Please use cronjobs.taskScheduler.enabled and/or cronjobs.archive.enabled
|
||
##
|
||
# enabled: true
|
||
taskScheduler:
|
||
## @param cronjobs.taskScheduler.enabled Whether to enable scheduled mail-to-task CronJob
|
||
##
|
||
enabled: true
|
||
## @param cronjobs.taskScheduler.schedule Kubernetes CronJob schedule
|
||
##
|
||
schedule: "*/5 * * * *"
|
||
## @param cronjobs.taskScheduler.suspend Whether to create suspended CronJob
|
||
##
|
||
suspend: false
|
||
## @param cronjobs.taskScheduler.affinity Affinity for CronJob pod assignment
|
||
##
|
||
affinity: {}
|
||
## @param cronjobs.taskScheduler.command Override default container command (useful when using custom images)
|
||
##
|
||
command: []
|
||
## @param cronjobs.taskScheduler.args Override default container args (useful when using custom images)
|
||
##
|
||
args: []
|
||
## @param
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.enabled Enabled containers' Security Context
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.privileged Set container's Security Context privileged
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.capabilities.drop List of capabilities to be dropped
|
||
## @param cronjobs.taskScheduler.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
|
||
##
|
||
containerSecurityContext:
|
||
enabled: true
|
||
seLinuxOptions: null
|
||
runAsUser: 1001
|
||
runAsNonRoot: true
|
||
privileged: false
|
||
readOnlyRootFilesystem: false
|
||
allowPrivilegeEscalation: false
|
||
capabilities:
|
||
drop: ["ALL"]
|
||
seccompProfile:
|
||
type: "RuntimeDefault"
|
||
## @param cronjobs.taskScheduler.podAnnotations Additional pod annotations
|
||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||
##
|
||
podAnnotations: {}
|
||
## @param cronjobs.taskScheduler.podLabels Additional pod labels
|
||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||
##
|
||
podLabels: {}
|
||
archive:
|
||
## @param cronjobs.archive.enabled Whether to enable scheduled mail-to-task CronJob
|
||
##
|
||
enabled: true
|
||
## @param cronjobs.archive.schedule Kubernetes CronJob schedule
|
||
##
|
||
schedule: "*/5 * * * *"
|
||
## @param cronjobs.archive.suspend Whether to create suspended CronJob
|
||
##
|
||
suspend: false
|
||
## @param cronjobs.archive.affinity Affinity for CronJob pod assignment
|
||
##
|
||
affinity: {}
|
||
## @param cronjobs.archive.command Override default container command (useful when using custom images)
|
||
##
|
||
command: []
|
||
## @param cronjobs.archive.args Override default container args (useful when using custom images)
|
||
##
|
||
args: []
|
||
## @param
|
||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||
## @param cronjobs.archive.containerSecurityContext.enabled Enabled containers' Security Context
|
||
## @param cronjobs.archive.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||
## @param cronjobs.archive.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
|
||
## @param cronjobs.archive.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
|
||
## @param cronjobs.archive.containerSecurityContext.privileged Set container's Security Context privileged
|
||
## @param cronjobs.archive.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
|
||
## @param cronjobs.archive.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
|
||
## @param cronjobs.archive.containerSecurityContext.capabilities.drop List of capabilities to be dropped
|
||
## @param cronjobs.archive.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
|
||
##
|
||
containerSecurityContext:
|
||
enabled: true
|
||
seLinuxOptions: null
|
||
runAsUser: 1001
|
||
runAsNonRoot: true
|
||
privileged: false
|
||
readOnlyRootFilesystem: false
|
||
allowPrivilegeEscalation: false
|
||
capabilities:
|
||
drop: ["ALL"]
|
||
seccompProfile:
|
||
type: "RuntimeDefault"
|
||
## @param cronjobs.archive.podAnnotations Additional pod annotations
|
||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||
##
|
||
podAnnotations: { }
|
||
## @param cronjobs.archive.podLabels Additional pod labels
|
||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||
##
|
||
podLabels: { }
|